ewanm89

1,258 reputation

210

bio	website	ewanm89.co.uk
	location	United Kingdom
	age	24
visits	member for	1 year, 10 months
	seen	yesterday
stats	profile views	125

I code for fun, mostly self taught, both high and low level. Also self taught in various aspects of information security. Love the puzzles.

	1,258 reputation	bio	website	ewanm89.co.uk	visits	member for	1 year, 10 months
210 badges		location	United Kingdom		seen	yesterday

summary answers questions tags badges favorites bounties reputation activity

544 Actions

suggestions reviews revisions comments badges posts accepts all

Sep 18	comment	Scan for mobile phones? but if you are trying to track a particular handset, the hash of the IMEI is no different from the IMEI itself. But, you exactly what data you store and what you discard is your choice.
Sep 17	comment	Scan for common web applications? I was just pointing out 900 is not a lot of fingerprints for the number of web applications nessus does fingerprinting as well as other checks just as your service does, I said it wasn't dedicated to web applications, but for the last decade they have been fingerprinting web applications as well as direct network services.
Sep 17	comment	Dangerous hardware ports? even with the media sensationalizing: theregister.co.uk/2011/06/27/mission_impossible_mouse_attack on thing can be guaranteed, you can get anyone to plug in unknown hardware.
Sep 17	comment	Dangerous hardware ports? or, I could just put a hardware keylogger on the wire. So far, no vulnerabilities needed with physical access, all I need to do is wait for administrator to log in.
Sep 17	comment	Dangerous hardware ports? one only needs to emulate a keyboard to input any keystroke one wishes. So, <Alt+F2>cmd<return> format c&<return> y<alt+esc> 5 mins later, well you get the picture.
Sep 17	comment	Scan for mobile phones? As for how you analyze and store the data, that's another matter. But even if we take the IMEI (internationally unique to each handset) and hash that, it's likely the hashes will be unique as the IMEI isn't longer than the hash.
Sep 17	comment	Scan for mobile phones? Without base station, you have to crack the encryption. But one can make a base station for GSM. It was don't for blackhat and defcon last year. The difficult bit is the actual radios.
Sep 17	comment	Dangerous hardware ports? Yeah, I can have all sorts of fun on the universal serial bus, and the PS2 mouse/keyboard aren't much better. To be honest, only video output is half safe and that's only cause we mask things like passwords.
Sep 17	answered	Scan for mobile phones?
Sep 17	comment	Scan for common web applications? Only 900 plugins? Nessus can do much the same stuff and has over 40,000 plugins, however it's not limited to web only.
Sep 17	comment	Scan for common web applications? Yes, but figuring all the different plugin combinations and creating definitions for those is problematic.
Sep 17	comment	Scan for common web applications? Some web application security scanners implement some of this functionality. But not all combinations are identifiable from the client and they need definition files to be used to define what too look for for what version. Also, easier to tell if vulnerable to a particular attack by running that attack.
Sep 16	comment	Asymmetric vs Symmetric Encryption There is no way to directly compare them. I would point out the only thing we can say is secure is one time truly random pad based XOR stream cipher (which is symmetric), however key exchange is a major problem. We can also say that we can, in theory, break RSA and El Gammel (the two main asymmetric) algorithms) with quantum computing, we just haven't built the device to actually do it..
Sep 2	comment	Convergence - an SSL replacement? @Nasko currently a failure to connect is considered a fail to authenticate for that notary.
Sep 2	comment	Convergence - an SSL replacement? I'd point out that Moxie Marlinspike is a friend of Dan Kaminsky (of DNSSEC fame), and they have had several conversations on twitter about the limitations of DNSSEC.
Aug 23	comment	Where do I securely store the key for a system where the source is visible? @Rob Cowell, I never said the requirements by the merchant bank is perfect, if one has physical access to the internals of the device doing the encryption/decryption one can always recover the data. There is no perfect solution to such a problem.
Aug 23	awarded	Enthusiast
Aug 7	comment	Where do I securely store the key for a system where the source is visible? check the rules as written by the merchant bank. They'll have specific rules about how much credit card number can be stored unencrypted for tracking transactions. And if one needs to store the whole number, how it must be encrypted.
Aug 1	comment	How to detect “forged” SSL certificates from the webserver end Mutual authentication is the only sure way, but there tends to need some user interaction for it to work.
Aug 1	comment	How to detect “forged” SSL certificates from the webserver end You are right, not pretty, the question is why can't you get this information from an ordinary webpage? It's not like it's that sensitive, unless it exposes the private keys, in which case, still, why not just not expose the private keys?